EUVD-2026-60914
GHSA-w2v7-qrj2-xj4h
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-accessible unauthenticated XSS with mandatory victim page visit (UI:R) and browser scope change (S:C); no direct availability impact from XSS alone, so A:N overrides the supplied A:L.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Ultimate Dashboard <= 3.11.2 versions.
AnalysisAI
Unauthenticated cross-site scripting in Ultimate Dashboard WordPress plugin versions 3.11.2 and earlier allows network-accessible, privilege-free attackers to inject arbitrary JavaScript that executes in the browser context of any authenticated user who visits the affected page. The CVSS scope change (S:C) confirms the payload breaks out of the plugin's context and operates under the WordPress origin, enabling session hijacking, credential harvesting, or forced privileged actions against administrators. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target WordPress site must have the Ultimate Dashboard plugin installed and active at version 3.11.2 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 score reflects a meaningful but bounded risk: low attack complexity and no authentication required (PR:N) lower the bar significantly, while mandatory user interaction (UI:R) prevents fully automated, zero-click exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Ultimate Dashboard to the first version above 3.11.2 - consult the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/ultimate-dashboard/vulnerability/wordpress-ultimate-dashboard-plugin-3-11-2-cross-site-scripting-xss-vulnerability for the exact patched release, as a specific fixed version number was not confirmed in the available intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations for Ultimate Dashboard plugin versions through 3.11.2 and immediately disable the plugin on affected systems if feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ultimate Dashboard
View allImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Vongries Ult
The Ultimate Dashboard WordPress plugin before 3.7.6 does not sanitise and escape some of its settings, which could allo
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allo
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allo
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allo
The Ultimate Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today